ci: guard upstream-only workflows behind repository check#48
Merged
Conversation
These eight workflow families are designed for openclaw/openclaw and can never succeed on this fork: CodeQL + opengrep want Blacksmith runner pools not provisioned here (CodeQL 0-for-8, opengrep 0-for-5 recent completions); labeler/auto-response need GitHub-App secrets (apps 2729701/2971289) never provisioned; real-behavior-proof's maintainer-skip needs the same missing GH_APP_TOKEN plus a 'maintainer' team that 404s in this org. Guard every entry/independent job with `github.repository == 'openclaw/openclaw'` so fork PRs stop accumulating permanent red/pending badges. Functional CI is untouched. Standard fork-safety pattern; trivially droppable on upstream sync. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Author
|
Anvil review status (2026-06-03): workflow-only diff looks correct, no code changes pushed by Anvil. Verification:
Current blockers/noise:
GitHub documents Maintainer decision needed: merge/apply this self-fixing workflow guard despite the known base-workflow red checks, or apply the equivalent change directly to |
LightDriverCS
added a commit
that referenced
this pull request
Jun 3, 2026
ci: guard Testbox workflows behind repository check (missed in #48)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Guards the eight upstream-only workflow families behind
if: github.repository == 'openclaw/openclaw'so fork PRs stop accumulating permanent red/pending badges from checks that can never succeed here. Functional CI untouched. (Note: this PR's own board still shows those badges one final time — pull_request_target runs main's unguarded versions.)Real behavior proof
Behavior or issue addressed: Eight workflow families inherited from upstream can never succeed on this fork — CodeQL/opengrep request Blacksmith runner pools not provisioned here, labeler/auto-response require GitHub-App secrets (apps 2729701/2971289) that don't exist in this org, and real-behavior-proof's maintainer-skip needs the same missing GH_APP_TOKEN plus a
maintainerteam that 404s. Every PR accumulates permanent red/pending badges, which today nearly stalled two merges.Real environment tested: This repository's live GitHub Actions history (the real failing system), plus local YAML parsing of all eight edited workflows on this branch.
Exact steps or command run after this patch:
ruby -ryaml -e "YAML.load_file(...)"across all 8 edited files;git diff --stat; and capturedgh run list/gh run view --log-failedoutput documenting the failure modes being guarded.Evidence after fix: Copied live output:
CodeQL history: 8 recent runs, 0 successes (queued/cancelled/failure). All 8 edited workflows parse as valid YAML; the repo's own
actionlintcheck validates them in this PR's CI.Observed result after fix: With guards in place, these jobs evaluate
ifto false on BenchAGI/openclaw and report as skipped instead of failing/queueing forever; on upstream the condition is true and behavior is unchanged. Verifiable on the first PR after merge.What was not tested: Upstream (openclaw/openclaw) execution of the guarded jobs — the guard preserves their condition verbatim there, and this fork cannot exercise upstream CI.
🤖 Generated with Claude Code